You need to create a service account so that Deckhouse can manage resources in the Google Cloud. Below is a brief sequence of steps to create a service account. If you need detailed instructions, you can find them in the provider’s documentation.

Note! The created service account key cannot be restored, you can only delete and create a new one.

Setup using Google Cloud Console

Follow this link, select your project and create a new service account or select an existing one.

The account must be assigned several necessary roles:

Compute Admin
Service Account User
Network Management Admin

You can add roles when creating a service account or edit them here.

To create a service account key in JSON format, click on three vertical dots in the Actions column and select Manage keys. Next, click on Add key -> Create new key -> Key type -> JSON.

Setup using gcloud CLI

To configure via the command line interface, follow these steps:

  1. Export environment variables:

    export PROJECT_ID=sandbox
    export SERVICE_ACCOUNT_NAME=deckhouse
  2. Select a project:

    gcloud config set project $PROJECT_ID
  3. Create a service account:

    gcloud iam service-accounts create $SERVICE_ACCOUNT_NAME
  4. Connect roles to the service account:

    for role in roles/compute.admin roles/iam.serviceAccountUser roles/networkmanagement.admin;
    do gcloud projects add-iam-policy-binding ${PROJECT_ID} --member=serviceAccount:${SERVICE_ACCOUNT_NAME}@${PROJECT_ID} \
       --role=${role}; done

    List of roles required:

  5. Verify service account roles:

    gcloud projects get-iam-policy ${PROJECT_ID} --flatten="bindings[].members" --format='table(bindings.role)' \
  6. Create a service account key:

    gcloud iam service-accounts keys create --iam-account ${SERVICE_ACCOUNT_NAME}@${PROJECT_ID} \